hash-pbkdf2.xml

<?xml version="1.0" encoding="utf-8"?>
<!-- $Revision$ -->
<refentry xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="function.hash-pbkdf2">
 <refnamediv>
  <refname>hash_pbkdf2</refname>
  <refpurpose>Generate a PBKDF2 key derivation of a supplied password</refpurpose>
 </refnamediv>

 <refsect1 role="description">
  &reftitle.description;
  <methodsynopsis>
   <type>string</type><methodname>hash_pbkdf2</methodname>
   <methodparam><type>string</type><parameter>algo</parameter></methodparam>
   <methodparam><type>string</type><parameter>password</parameter></methodparam>
   <methodparam><type>string</type><parameter>salt</parameter></methodparam>
   <methodparam><type>int</type><parameter>iterations</parameter></methodparam>
   <methodparam choice="opt"><type>int</type><parameter>length</parameter><initializer>0</initializer></methodparam>
   <methodparam choice="opt"><type>bool</type><parameter>binary</parameter><initializer>&false;</initializer></methodparam>
  </methodsynopsis>
 </refsect1>

 <refsect1 role="parameters">
  &reftitle.parameters;
  <para>
   <variablelist>
    <varlistentry>
     <term><parameter>algo</parameter></term>
     <listitem>
      <para>
       Name of selected hashing algorithm (i.e. <literal>md5</literal>,
       <literal>sha256</literal>, <literal>haval160,4</literal>, etc..) See
       <function>hash_algos</function> for a list of supported algorithms.
      </para>
     </listitem>
    </varlistentry>
    <varlistentry>
     <term><parameter>password</parameter></term>
     <listitem>
      <para>
       The password to use for the derivation.
      </para>
     </listitem>
    </varlistentry>
    <varlistentry>
     <term><parameter>salt</parameter></term>
     <listitem>
      <para>
       The salt to use for the derivation. This value should be generated randomly.
      </para>
     </listitem>
    </varlistentry>
    <varlistentry>
     <term><parameter>iterations</parameter></term>
     <listitem>
      <para>
       The number of internal iterations to perform for the derivation.
      </para>
     </listitem>
    </varlistentry>
    <varlistentry>
     <term><parameter>length</parameter></term>
     <listitem>
      <para>
       The length of the output string. If <parameter>binary</parameter>
       is &true; this corresponds to the byte-length of the derived key, if
       <parameter>binary</parameter> is &false; this corresponds to twice the
       byte-length of the derived key (as every byte of the key is returned as
       two hexits).
      </para>
      <para>
       If <literal>0</literal> is passed, the entire output of the supplied
       algorithm is used.
      </para>
     </listitem>
    </varlistentry>
    <varlistentry>
     <term><parameter>binary</parameter></term>
     <listitem>
      <para>
       When set to &true;, outputs raw binary data. &false; outputs lowercase
       hexits.
      </para>
     </listitem>
    </varlistentry>
   </variablelist>
  </para>
 </refsect1>

 <refsect1 role="returnvalues"><!-- {{{ -->
  &reftitle.returnvalues;
  <para>
   Returns a string containing the derived key as lowercase hexits unless
   <parameter>binary</parameter> is set to &true; in which case the raw
   binary representation of the derived key is returned.
  </para>
 </refsect1><!-- }}} -->

 <refsect1 role="errors"><!-- {{{ -->
  &reftitle.errors;
  <para>
   Throws a <classname>ValueError</classname> exception if the algorithm is
   unknown, the <parameter>iterations</parameter> parameter is less than or
   equal to <literal>0</literal>, the <parameter>length</parameter> is less
   than <literal>0</literal> or the <parameter>salt</parameter> is too long
   (greater than <constant>INT_MAX</constant><literal> - 4</literal>).
  </para>
 </refsect1><!-- }}} -->

 <refsect1 role="changelog">
  &reftitle.changelog;
  <para>
   <informaltable>
    <tgroup cols="2">
     <thead>
      <row>
       <entry>&Version;</entry>
       <entry>&Description;</entry>
      </row>
     </thead>
     <tbody>
      <row>
       <entry>8.0.0</entry>
       <entry>
        Now throws a <classname>ValueError</classname> exception on error.
        Previously, &false; was returned and an <constant>E_WARNING</constant>
        message was emitted.
       </entry>
      </row>
      <row>
       <entry>7.2.0</entry>
       <entry>Usage of non-cryptographic hash functions (adler32, crc32, crc32b, fnv132, fnv1a32, fnv164, fnv1a64, joaat) was disabled.</entry>
      </row>
     </tbody>
    </tgroup>
   </informaltable>
  </para>
 </refsect1>

 <refsect1 role="examples">
  &reftitle.examples;
  <para>
   <example>
    <title><function>hash_pbkdf2</function> example, basic usage</title>
    <programlisting role="php">
<![CDATA[
<?php
$password = "password";
$iterations = 600000;

// Generate a cryptographically secure random salt using random_bytes()
$salt = random_bytes(16);

$hash = hash_pbkdf2("sha256", $password, $salt, $iterations, 20);
var_dump($hash);

// for raw binary, the $length needs to be halved for equivalent results
$hash = hash_pbkdf2("sha256", $password, $salt, $iterations, 10, true);
var_dump(bin2hex($hash));?>
]]>
    </programlisting>
    &example.outputs.similar;
    <screen>
<![CDATA[
string(20) "120fb6cffcf8b32c43e7"
string(20) "120fb6cffcf8b32c43e7"
]]>
    </screen>
   </example>
  </para>
 </refsect1>

 <refsect1 role="notes">
  &reftitle.notes;
  <caution>
   <para>
    The PBKDF2 method can be used for hashing passwords for storage. However, it
    should be noted that <function>password_hash</function> or
    <function>crypt</function> with <constant>CRYPT_BLOWFISH</constant> are
    better suited for password storage.
   </para>
  </caution>
 </refsect1>

 <refsect1 role="seealso">
  &reftitle.seealso;
  <para>
   <simplelist>
    <member><function>password_hash</function></member>
    <member><function>hash_hkdf</function></member>
    <member><function>sodium_crypto_pwhash</function></member>
   </simplelist>
  </para>
 </refsect1>

</refentry>
<!-- Keep this comment at the end of the file
Local variables:
mode: sgml
sgml-omittag:t
sgml-shorttag:t
sgml-minimize-attributes:nil
sgml-always-quote-attributes:t
sgml-indent-step:1
sgml-indent-data:t
indent-tabs-mode:nil
sgml-parent-document:nil
sgml-default-dtd-file:"~/.phpdoc/manual.ced"
sgml-exposed-tags:nil
sgml-local-catalogs:nil
sgml-local-ecat-files:nil
End:
vim600: syn=xml fen fdm=syntax fdl=2 si
vim: et tw=78 syn=sgml
vi: ts=1 sw=1
-->